I have a Windows executable file that has been code signed with a certificate from a Certificate Authority. The CA is listed in the official Microsoft Trusted Root Program list of participants. The level of my cert is Open Source, which is below EV and Standard, so reputation must be built.

  1. Is the reputation attached to the application, or the certificate? That is, if you build reputation for a year then release a hotfix, is the reputation reset?
  2. Besides Microsoft Smart Screen, does code signing affect the likelihood of Chrome downloads, AVG, ESET, Norton, etc marking it as suspicious?
  3. Before reputation is built, does having the application signed make it less suspicious to Microsoft, Chrome, etc whatsoever?
  • I believe we used to have problems when updating until we realized that submitting each release for Windows certification made the reputation carry over... and of course you'll be able to claim "Windows xxx certified": learn.microsoft.com/en-us/windows/win32/win_cert/… we discovered this a long time ago, so not sure it still applies. Signing with a CA's cert will definitely help quiet UAC prompts to "run anyway".... virus scans would still happen so it wouldn't affect the likelihood of false positives from any scan. Oct 27, 2023 at 18:55
  • That's the general problem with questions like this. Policies are specific to a company, and they may change in time. Better try and find the official documentation. And yes, I'm not voting to close or anything, we're talking about Microsoft documentation after all ;) Nov 3, 2023 at 21:12
  • Understood it's hard to say. Appreciate the perspective still.
    – Ron
    Nov 23, 2023 at 0:44


You must log in to answer this question.

Browse other questions tagged .